The SurveyJS Drag & Drop WordPress Form Builder contains a CSRF vulnerability due to missing or incorrect nonce validation on the SurveyJS_CloneSurvey AJAX action. An attacker can send a forged request that, when an administrator clicks a link or visits a malicious page, causes the site to duplicate a survey without the administrator’s consent. The result is unauthorized replication of survey definitions, potential exposure of sensitive respondent data, and clutter of the site with unwanted copies.

The vulnerability affects all versions of devsoftbaltic’s SurveyJS Drag & Drop Form Builder up to and including 2.5.2. WordPress sites that have installed any of these plugin versions are susceptible; site administrators who grant media or form creation privileges are at risk.

The CVSS score of 4.3 indicates moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to lure an administrator into performing the clone form action, typically via social engineering or a malicious link. Once triggered, the attacker can duplicate surveys and thereafter use or delete them as desired.